NIS2 in One Paragraph
- Directive (EU) 2022/2555
- covered essential and important entities
- cybersecurity risk management
- incident reporting
- management responsibility
- national implementation
Who NIS2 Can Apply To
- covered sectors and services
- organisation size
- special inclusion rules
- essential and important entities
- cross-border and national jurisdiction questions
The Core NIS2 Compliance Responsibilities
- management-body responsibility
- Article 21 cybersecurity risk-management measures
- incident handling
- business continuity
- supply-chain security
- security testing and effectiveness
- cyber hygiene and access control
Incident Reporting Under NIS2
- significant incidents
- early warning
- incident notification
- final reporting
- CSIRT or competent authority
- internal escalation before external reporting
The 17 October 2024 Transposition Deadline
- EU transposition deadline
- national implementing laws
- national registration procedures
- competent-authority guidance
- do not assume implementation is identical in every Member State
Essential and Important Entities Are Not Two Different Compliance Worlds
- both categories have core cybersecurity obligations
- classification affects supervision and enforcement context
- scope and classification should be documented
- national rules remain relevant
How to Start a NIS2 Compliance Programme
- confirm scope and jurisdiction
- identify management ownership
- map Article 21 measures to existing controls
- identify evidence gaps
- prepare incident-reporting workflow
- track national and EU changes
Frequently asked questions
Is NIS2 a regulation that applies identically in every EU country?
No. NIS2 is a Directive. It establishes an EU framework, but Member States implement it through national law, so organisations should check the law and competent-authority guidance for the Member State that has jurisdiction.
Did the NIS2 transposition deadline already pass?
Yes. The Directive required Member States to adopt and publish the necessary transposition measures by 17 October 2024. Practical implementation and national guidance can still continue to evolve after that date.
Does NIS2 only require technical cybersecurity controls?
No. NIS2 combines technical and organisational cybersecurity measures with management oversight, incident reporting, business continuity, supply-chain security, training, evidence and regulatory supervision.
Related NIS2 guidance
Official sources
This general editorial guidance does not determine
your organisation's legal obligations. Review current
official sources, applicable national law and guidance
from the relevant competent authority.